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Abstract 

This paper considers distributed computing on an anonymous quantum network, a network in which 
no party has a unique identifier and quantum communication and computation are available. It is proved 
that the leader election problem can exactly (i.e., without error in bounded time) be solved with at most 
the same complexity up to a constant factor as that of exactly computing symmetric functions (without 
intermediate measurements for a distributed and superposed input), if the number of parties is given 
to every party. A corollary of this result is a more efficient quantum leader election algorithm than 
existing ones: the new quantum algorithm runs in 0(n) rounds with bit complexity 0(mn 2 ), on an 
anonymous quantum network with n parties and m communication links. It follows that all Boolean 
functions computable on a non-anonymous quantum network can be computed with the same order of 
complexity as the quantum leader election algorithm on an anonymous quantum network. This gives the 
first quantum algorithm that exactly computes any computable Boolean function with round complexity 
0(n) and with smaller bit complexity than that of existing classical algorithms in the worst case over all 
(computable) Boolean functions and network topologies. More generally, any n-qubit state can be shared 
with that complexity on an anonymous quantum network with n parties. This paper also examines an 
important special case: the problem of sharing an n-partite GHZ state among n parties on an anonymous 
quantum network. It is proved that there exists a quantum algorithm that exactly solves this problem 
with rounds linear in the number of parties with a constant-sized gate set. 
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1 Introduction 



1.1 Background 

Distributed computing algorithms often depend on the assumption that messages sent by distinct parties can 
be distinguished, which is justified if every party has a unique identifier. A more general case without this 
assumption is an anonymous network, i.e., a network where no party has a unique identifier. Computing on 
anonymous networks was first considered with the leader election problem in Ref. ||2l and has been further 
investigated in the literature (e.g., Refs. (9) [TOl CD [HI |20l ETJ). This setting makes it significantly hard or 
even impossible to solve some distributed computing problems that are easy to solve on a non-anonymous 
network. 

The leader election problem is the problem of electing a unique leader from among distributed parties 
and it is a fundamental problem: Once it is solved, the leader can gather all distributed input and locally 
solve any distributed computing problem (except cryptographic or fault-tolerant problems) (e.g., Ref. [15]). 
However, it was proved in Refs. (U [I9j |20l that no classical algorithm can exactly solve the leader election 
problem on anonymous networks for a certain broad class of network topologies, such as rings and a certain 
family of regular graphs, even if the network topology (and thus the number of parties) is known to each 
party prior to algorithm invocation. Here, an algorithm is said to exactly solve a problem if it solves the 
problem without fail in bounded time. Thus, many other problems have also been studied to clarify their 
solvability on anonymous networks: some were shown to be exactly solvable (for certain families of graphs) 
and others were not ll20l . For instance, any symmetric Boolean function can be computed on an anonymous 
network of any unknown topology, if the number of parties is given to each party |fl9l l20l [T4l ; in particular, 
efficient algorithms are known for various regular graphs (e.g., Refs. l[3l [T2l[T4l[T3lO . 

Surprisingly, the situation is quite different on quantum networks, i.e., networks in which quantum 
computation and communication are available. It was proved by the present authors in Ref. [180 that the 
leader election problem can exactly be solved on an anonymous quantum network of any unknown topology, 
if the number of parties is given to every party. This implies that quantum power substantially changes the 
computability of the leader election problem on anonymous networks. 

Our questions are then as follows: How powerful is quantum information for solving distributed comput- 
ing tasks? Does quantum power change the hardness relation among distributed computing problems (e.g., 
problem A is harder than problem B in the classical setting, while they have similar hardness in the quantum 
setting)? We give an answer to these questions by comparing the leader election problem with computing 
symmetric functions, well-known problems that can be solved even on an anonymous classical network. As 
a corollary, we provide a more efficient quantum leader election algorithm than existing ones. For every 
Boolean function computable on a non-anonymous quantum network (a quantum network in which every 
party has a unique identifier), this yields a quantum algorithm that computes it on an anonymous quantum 
network with the same order of complexity as the quantum leader election algorithm. In distributed quantum 
computing, sharing a quantum state among parties is also a fundamental problem. The above algorithm of 
computing Boolean functions actually solves the problem of n parties sharing any quantum state. We also 
examine an important special case: the problem of sharing an n-partite GHZ state among n parties on an 
anonymous quantum network, called the GHZ-state sharing problem. 

1.2 Main Results 

Hereafter, we assume that the underlying graphs of networks are undirected and that no faults exist on 
networks. 

1 A nice survey of this article is found in Ref. (6) 
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1.2.1 Quantum Leader Election 



Our first result shows that the leader election problem is not harder than computing symmetric functions 
on anonymous quantum networks. Let n be the number of parties and : {0, 1}™ — > {true, false} be the 
function over distributed n bits, which is true if and only if the Hamming weight, i.e., the sum, of the n bits 
is k. Let Hk be any quantum algorithm that exactly computes H^ without intermediate measurement^] on an 
anonymous quantum network, and let Q rnd (%fc)and Q hlt {T-Lk) be the worst-case round and bit complexities 
of Hk over all possible quantum states as inputo 

Theorem 1 If the number n of parties is provided to each party, the leader election problem can exactly be 
solved in 0(Q Tnd (7io) + Q rnd (Hi)) rounds with bit complexity O(Q ut (7i ) + Q hit (7ii)) on an anonymous 
quantum network of any unknown topology. 

This is the first non-trivial characterization of the complexity of leader election relative to computing 
Boolean functions on anonymous quantum networks. This does not have a classical counterpart, since, for 
some network topologies (e.g., rings), symmetric Boolean functions can exactly be computed |[T9l l20l IT4l 
but a unique leader cannot exactly be elected l20l . In fact, any symmetric function can exactly be com- 
puted on an anonymous classical network of any unknown topology (and thus, on an anonymous quantum 
network). Therefore, Theorem Q] subsumes the computability result in Ref. lfT8l that the leader election 
problem can exactly be solved on an anonymous quantum network. Our second result is that computing H\ 
is reducible to computing Hq. 

Theorem 2 If the number n of parties is provided to each party, Hi can exactly be computed without inter- 
mediate measurements for any possible quantum states as input in 0(Q md ('Ho)) rounds with bit complexity 
0(n • Q blt (%o)) ° n an anonymous quantum network of any unknown topology. 

Theorem Q] together with Theorem [2] implies that the complexity of the leader election problem is charac- 
terized by that of computing Hq. This would be helpful in intuitively understanding the hardness of the 
leader election problem on an anonymous quantum network, since computing Hq can be interpreted as just 
a simple problem of checking if all parties have the same value. 

Since Theorem Q] (Theorem 13 is proved by quantumly reducing the leader election problem (resp. com- 
puting Hi) to computing Hq and H\ (resp. computing Hq), the theorems provide ways of developing quan- 
tum leader election algorithms by plugging in algorithms that compute Hq (and Hi). Since there is a 
classical algorithm that exactly computes Hq in O(n) rounds with bit complexity 0(mn) for the number 
m of edges of the underlying graph (e.g., Ref. Ifl4l0 and it can be converted into a quantum algorithm with 
the same complexity up to a constant factor, Theorem Q] together with Theorem [2] yields a quantum leader 
election algorithm. 



2 The condition "without intermediate measurements" is required for clear definition. It is easy to convert any quantum algorithm 
involving intermediate measurements into a quantum algorithm not involving them by postponing all the measurements. However, 
this conversion may increase the bit complexity and, thus, these two kinds of algorithms should be considered separately. For 
instance, consider a quantum algorithm involving intermediate measurements that uses a different subset of communication links for 
each intermediate measurement results, in which case the algorithm uses the union of the subsets when postponing the intermediate 
measurements. 

3 Note that inputs are not limited to classical inputs when we consider the complexities of quantum algorithms that compute 
classical functions. For instance, 7-Lk can take a state of the form as \x) as input, where aj £ C and x g {0, 1}". This takes 
it into account that the algorithm may use smaller amounts of communications when restricted to classical inputs. For instance, for 
each classical input, the algorithm may use a different subset of communication links, in which case it uses the union of these subsets 
of communication links when the input is a superposition of such classical inputs, and may result in the increase of communication 
complexities. Hence, the correct way of defining complexities of quantum algorithms that are used as subroutines is taking the 
maximum over all possible inputs, including quantum inputs. 
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Corollary 3 The leader election problem can exactly be solved in 0(n) rounds with bit complexity 0(mn 2 ) 
on an anonymous quantum network for any unknown topology, if the number n of parties is given to every 
party, where m is the number of edges of the underlying graph. 

This leader election algorithm has better round and bit complexity than existing algorithms — the two 
quantum algorithms given in Ref. |[T8l have the round [bit] complexity of 0(n 2 ) [0(mn 2 )] and 0(n log n) 
[0(mn 4 log n)], respectively Actually, the proofs of Theorems [T]and|2]can be carried over asynchronous 
networks in a straightforward manner. Thus, the theorems hold for asynchronous networks. 

1.2.2 Quantum State Sharing 

Once a unique leader is elected, it is possible to construct a spanning tree and assign a unique identifier 
drawn from {1, . . . , n} to each party with the same order of complexity as that of electing a unique leader 
on anonymous quantum networks^ Then, the leader can recognize the underlying graph by gathering along 
the spanning tree the adjacency matrices of subgraphs with a unique identifier on each node. This implies 
that, if every party i is given a bit x-i as input, a unique leader (who is elected by the leader election algorithm) 
can compute any Boolean function f{x\, . . . , x n ) that depends on the underlying graph G with node label 
XiS (and send the function value to every party along the spanning tree). Here, the index i of each party is 
introduced just for explanation, and it is not necessarily the same as the identifier assigned by the leader to 
the party having Xj. An example of / is a majority function that is true if and only if the sum over all Xj's is 
more than n/2. Another example is a function that is true if and only if there is a cycle in which each node 
i has input Xi = 1. Similarly, if each party is given a qubit as node label so that the n parties share some 
n-qubit state £, the leader can generate any quantum state p computable from £ and the underlying graph G. 

Corollary 4 Suppose that every party i is given the number n of parties and a qubit as node label so 
that the n parties share some n-qubit state £. Let p be any n-qubit quantum state computable from £ and 
the underlying graph. Then, state p can exactly be shared among the n parties in 0(n) rounds with bit 
complexity 0(mn 2 ) on an anonymous quantum network, where m is the number of edges of the underlying 
graph. A special case of f is a Boolean function that is determined by the underlying graph in which each 
node i is labeled with a bit X{. If every party i is given n and Xi, function f can exactly be computed in 
0{n) rounds with bit complexity 0(mn 2 ) on an anonymous quantum network. 

This gives the first quantum algorithm that exactly computes any computable Boolean function with round 
complexity 0(n) and with smaller bit complexity than that of existing classical algorithms ll20l [141 [T8l in 
the worst case over all (computable) Boolean functions and network topologies. 

GHZ-State Sharing From the viewpoint of quantum information, our leader election algorithm exactly 
solves the problem of sharing an n-partite Hastate (e.g., a state ( 1 100) + 1 010) +|001))/\/3 for the three- 
party case). As described above, this essentially solves the more general problem of sharing an n-qubit state 
p. We are then interested in whether a certain non-trivial p can be shared with less computational resources 
than a VF-state. Specifically, we focus on the number of distinct quantum gates required to share p, since, for 
the leader election problem, all known exact algorithms (including ours) require quantum gates that depend 
on the number n of parties. 

Among non-trivial quantum states other than Upstates, an n-partite GHZ state would be one of the most 
interesting quantum states, since it would be a useful resource for quantum computing and communication. 

4 The problem of assigning unique identifiers drawn from a small domain has been widely studied even for non-anonymous 
networks since the length of each identifier has a great influence over the bit complexity of many problems. 
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We give exact quantum algorithms that solve, with a constant-sized gate set, the problem of sharing an n- 
partite GHZ state {or an n-partite cat state) (|0)® n + |l)® n )/v / 2 with qubits, and the problem of sharing 
an n-partite generalized-GHZ state (|0)® n +• • • +\k — l)® n )/\/fc with fe-level qudits for a constant integer 
k > 2, among n parties on an anonymous quantum network. We call this problem the GHZ-state sharing 
problem. Notice that /c-level qudits are physically realizable lfl6l and are just qubits for k = 2. Let Fp. be a 
function such that Fk(x\, . . . , x n ) = Y2i=i x i ( m od k) for distributed inputs G {0, . . . , k — 1}. Let Tk 
be any quantum algorithm that exactly computes Ff. without intermediate measurements on an anonymous 
network, and let Q (J-fc) and Q hlt (Tk) be the worst-case round and bit complexities, respectively, of 
over all possible quantum states as input. 

Theorem 5 If every party is given the number n of party and an integer k > 2, the GHZ-state sharing prob- 
lem can exactly be solved on an anonymous quantum network in 0(Q rnd (J-k)) rounds with bit complexity 
0{Q hlt {J-k))- Moreover, every party uses only a constant-sized gate set to perform all operations for any 
integer constant k > 2, if an algorithm is given as a black box. 

For every integer constant k > 2, there is an algorithm that exactly and reversibly computes F^ for 
any possible quantum state as input in 0(n) rounds with bit complexity 0(mn 4 log n) on an anonymous 
classical/quantum network of any unknown topology [18]. Therefore, the theorem implies that there exists 
a quantum algorithm that exactly solves the GHZ-state sharing problem with a constant-sized gate set for 
any constant k > 2. For k = 2, we have the following corollary. 

Corollary 6 The GHZ-state sharing problem with k = 2 can exactly be solved on an anonymous quantum 
network for any number n of parties with a gate set that can perfectly implement the Hadamard transfor- 
mation and any classical reversible transformations. In particular, the problem can exactly be solved with 
either the Shor basis or the gate set consisting of the Hadamard gate, the CNOT gate, and the Toffoli gate. 

If much more rounds are allowed, there exists a more bit-efficient algorithm that exactly solves the GHZ- 
state sharing problem in 0(n 2 ) rounds with bit complexity 0(mn 2 ) by using only a constant-sized gate set 
for any n. The algorithm is obtained by modifying Algorithm I in Ref. [181- 

1.3 Related Work 

Refs. |[r7l 171 have dealt with the leader election and GHZ-state sharing problems in a different setting where 
pre-shared entanglement is assumed but only classical communication is allowed. The relation between 
several network models that differ in available quantum resources is discussed in Ref. (H. 

1.4 Organization 

Section 2 describes the network model, and some tools and notations used in the paper. Sections 3 and 4 
prove Theorems Q] and [2] Section 5 then gives a quantum leader election algorithm as a corollary of the 
theorems. Section 6 considers the problems of computing Boolean functions and sharing a quantum state. 
Section 7 presents a quantum algorithm for the GHZ-state sharing problem. 

2 Preliminaries 

2.1 Distributed Computing 

The Network Model: A classical network is composed of multiple parties and bidirectional classical com- 
munication links connecting parties. In a quantum network, every party can perform quantum computation 
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and communication, and each adjacent pair of parties has a bidirectional quantum communication link be- 
tween them (we do not assume any prior shared entanglement). When the parties and links are regarded as 
nodes and edges, respectively, the topology of the network is expressed by a connected undirected graph. 
We denote by Q n the set of all n-node connected undirected graphs with no multiple edges and no self-loops. 
In what follows, we may identify each party/link with its corresponding node/edge in the underlying graph 
for the system, provided that doing so is not confusing. Every party has ports corresponding one-to-one 
to communication links incident to the party. Every port of party I has a unique label i, (1 < i < df), 
where di is the number of parties adjacent to I. More formally, the underlying graph G = (V, E) has a port 
numbering |[20l . which is a set a of functions {o-[v] : v G V} such that, for each node v of degree d v , a[v] 
is a bijection from the set of edges incident to v to {1, 2, ... , d v }. It is stressed that each function a[v] may 
be defined independently of any other cr[v']. In our model, each party knows the number of his ports and the 
party can appropriately choose one of his ports whenever he transmits or receives a message. 

Initially, every party / has local information //, the information that only party / knows, such as his local 
state and the number of his adjacent parties, and global information Iq, the information shared by all parties 
(if it exists), such as the number of parties in the system (there may be some information shared by not all 
parties, but it is not necessary to consider such a situation when defining anonymous networks). Every party 
/ runs the same algorithm, which is given local and global informations, I\ and Iq, as its arguments. If all 
parties have the same local information except for the number of ports they have, the system and the parties 
in the system are said to be anonymous. For instance, if the underlying graph of an anonymous network is 
regular, this is essentially equivalent to the situation in which every party has the same identifier (since we 
can regard the local information // of each party / as his identifier). This paper deals with only anonymous 
networks, but may refer to a party with its index (e.g., party i) only for the purpose of simple description. 

A network is either synchronous or asynchronous. In the synchronous case, message passing is per- 
formed synchronously. The unit interval of synchronization is called a round. Following the approach in 
Ref. 02], one round consists of the following two sequential steps, where we assume that two (probabilis- 
tic) procedures that generate messages and change local states are defined in the algorithm invoked by each 
party: (1) each party changes his local state according to a procedure that takes his current local state and 
the incoming messages as input, and then removes the messages from his ports; (2) each party then prepares 
messages and decides the ports through which the messages should be sent by using the other procedure 
that takes his current local state as input, and finally sends the messages via the ports. Notice that, in the 
quantum setting, the two procedures are physically realizable operators. A network that is not synchronous 
is asynchronous. In asynchronous networks, the number of rounds required by an algorithm is defined by 
convention as the length of the longest chains of messages sent during the execution of the algorithm. 

This paper focuses on the required number of rounds as a complexity measure (called round complexity). 
This is often used as an approximation of time complexity, which includes the time taken by local operations 
as well as that taken by message exchanges. Another complexity measure we use is bit complexity, which is 
the number of bits, including qubits, communicated over all communication links. In this paper, we do not 
assume any faulty party and communication link. 

2.2 Leader Election Problem in Anonymous Networks 

The leader election problem is formally defined as follows. 

Definition 7 (n-party leader election problem (LE n )) Suppose that there is an n-party network whose 
underlying graph is in Qn> and that each party z E {1, 2, . . . , ti^ in the network, has a vo.vio.blc y% initialized 
to 1. Create the situation in which y^ = lfor a certain fc E {l,2,...,n} and yi = Ofor every i in the rest 
{l,2,...,n}\{A;}. 
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This paper considers LE n on an anonymous network (when each party i has his own unique identifier, i.e., 
Ii / Ij for all distinct i, j G {1, . . . ,n}, LE n can deterministically be solved in ©(n) rounds in both 
synchronous and asynchronous cases lfl~5l ). 

The leader election problem on an anonymous network was first investigated by Angluin Q. Subse- 
quently, Yamashita and Kameda [20] gave a necessary and sufficient condition on network topologies under 
which LE n can exactly be solved for given n. Their result implies that LE n cannot exactly be solved for a 
broad class of graphs, including rings, complete graphs, and certain families of regular graphs. Interested 
readers should consult Refs. [T] |22j and the references in them for detailed information about the leader 
election problem on anonymous networks. 

2.3 Quantum Computing 

We assume that readers have some basic knowledge of quantum computing introduced in standard textbooks 
lfl6l[TTlL The following well-known theorem is called "exact quantum amplitude amplification", which will 
be used repeatedly. 

Theorem 8 (|IU|5||) Let A be any quantum algorithm that searches for z G {0, 1}™ such that x( z ) = true 
without using measurements, where x( z ) e {true, false} is any Boolean function. Suppose that 

\^)=A\or n = Y,^\z) 

z 

for orthonormal basis {|^)} 2 e{o,i} n - Let Q(A, Xi (f>, 9) be an operator 

where F x {9) multiplies \z) by a factor of e ld if xi z ) = true, and Fq(<P) multiplies \z) by a factor of if 
z = • • • 0. 

If the initial success probability a = Yl z - x(^)=true \ a z\ 2 °f A is exactly known and at least 1/4, then 

Q(A,x,<t>a,0 a )\V) = -7= J2 a ^ 

z- x(2j=true 

for some values cp a and 9 a (0 < (j) a , 9 a < 2ir) computable from a. 

2.4 Notations 

A Boolean function / : {0, 1}™ — > {true, false} depending on n variables, x\, ■ ■ ■ , x n with x% G {0, 1}, is 
said to be symmetric if / is determined by the Hamming weight of x = {x\, . . . , x n ), i.e., \x\ = Y17=i x i- 
In particular, symmetric function Hk : {0, l} n — > {true, false} is defined as Hk(x) = true if and only if \x\ 
is k. We say that n parties exactly compute a Boolean function f : {0, l} n — > {true, false} if every party i 
has variables yi (initialized to "true") and X{ G {0, 1} before computation, and set yi to f(x) with certainty 
after computation. If a quantum algorithm exactly computes / without intermediate measurements on an 
anonymous quantum network, we say that the algorithm is an f -algorithm. 

In general, an /-algorithm transforms (with ancilla qubits) an input state [(^)™ =1 (|xi)|true))] <g> |0) into 
[(8>r=i(l x i)l/(^)))] ® \92)> for an Y % = (^1; •••,Vn) G {0, l} n , where \g s ) is "garbage" left after com- 
puting f(x). For the algorithms over networks with bidirectional communication links, any /-algorithms 
are reversible. Hence we can totally remove the "garbage" by standard garbage-erasing technique, as the 
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/-algorithm exactly and reversibly computes /. Putting everything together, we may assume without loss 
of generality (at the cost of doubling each complexity) that any /-algorithm transforms an input state 

n 

a £ (g) (1^)1 true)) 
xe{o,i} n i=l 

into 

n 

E «*®(te>i/(*)»> 

xe{o,i} n i=i 

for any G C with X^e{o i} n l a d 2 = 1> where x = (x\, . . . ,x n ). Similarly, for the more general 
function / : X n — > Y depending on distributed n variables (xi, . . . , x n ) with Xj G X, we say that a quan- 
tum algorithm is an /-algorithm, if the algorithm exactly computes / without intermediate measurements 
on an anonymous quantum network. For an /-algorithm F on an anonymous quantum network with the 
underlying graph G G Q n , we denote by Q ] Q t (F) and Q t q A (F) *h e worst-case bit and round complexities, 
respectively, of F over all possible quantum states given as input. For simplicity, we may write Q blt (F) and 
Q ind (F) if G is clear from context. 

3 Proof of Theorem [I] 

3.1 Basic Idea 

Initially, every party is eligible to be the leader and is given the number n of parties as input. Every party 
flips a coin that gives heads with probability 1/n and tails with 1 — 1/n. If exactly one party sees heads, the 
party becomes a unique leader. The probability of this successful case is given by 

S ^={l)-n\—) =[ 1 -n) > e > 4- 

We shall amplify the probability of this case to one by applying the exact quantum amplitude amplification 
in Theorem [8] To do this, we use an i?i -algorithm in a black-box manner to check (in F x (9 s r n \)) whether 
or not a run of the above randomized algorithm results in the successful case, and use an .ffo" ai g or i tri m 
in a black-box manner to realize the diffusion operator (more strictly, i*b(0 s (n)))- m other words, we shall 
quantumly reduce the leader election problem to computing Hq and H\. In our algorithm, all communication 
is performed for computing Hq, Hi and their inversions. The non-trivial part is how to implement F X (6 S ^) 
and i ? o( ( / ) s(n)) i n a distributed way on an anonymous network, where s(n) = (1 — 1/n)™" 1 , since every 
party must run the same algorithm. 

3.2 The Algorithm 

Before describing the algorithm, we introduce the concept of solving and unsolving strings. Suppose that 
each party i has a bit Xj, i.e., the n parties share n-bit string x = [x\, X2, ■ ■ ■ , x n ). A string x is said to be 
solving if x has Hamming weight one. Otherwise, x is said to be unsolving. We also say that an n-qubit 
pure state \ip) = Ylx&{o i} n a s\%) shared by the n parties is solving (unsolving) if ctg ^ only for x that is 
solving (unsolving). 

Fix an T/o-algorithm and an H\ -algorithm, which we are allowed to use in a black-box manner. 
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Base algorithm A: Let A be the two-by-two unitary matrix denned by 



A = 



y/n V 1 -y/n - 1 



At the beginning of the algorithm, each party prepares three single-qubit quantum registers R, S, and S', 
where the qubit in R is initialized to |0), the qubits in S and S' are initialized to |"true") (the qubits in S 
and S' will be used as ancillary qubits when performing phase-shift operations on the qubit in R). First, 



each party applies A to the qubit in R to generate the quantum state = A|0) = \Jl — ^ |0) + \J~^ 1 1). 
Equivalently, all n parties share the re-qubit quantum state 



(gin 




l*) = IV>> 

in their R's. Let S n = {x 6 {0, l} ra : x is solving} be the set of solving strings of length n, and let 
I ^solving) = ^ YlxeS n \%) ^ e ^ e q uanm m state which is the uniform superposition of solving strings 
of length n. Notice that is a superposition of the solving state ^solving) and some unsolving state 

I ^unsolving) • 

1^) ^solving I ^solving) C^unsolving I ^unsolving) • 



The amplitude a solving of |^ so | vin g) is given by a so | ving = y/s(n) > 1/2. 

Exact amplitude amplification: Now the task for the n parties is to amplify the amplitude of (^solving) 
to one via exact amplitude amplification, which involves one run of — AFo(4> a )A~ l F x {6 a ) for A = A®" 
since the initial success probability is caving > 1/4. 

To realize F x (9 8 ^) in a distributed manner, where x(x) = 1 if x is solving and x(%) = otherwise, 

each party wants to multiply the amplitude of any basis state \x) for = 1 by a factor of e*" 61 ^™) , where 
s(n) = (1 — l/n) n_1 . This will multiply the amplitude of the basis state by a factor of e ldal - n ^ as a whole. At 
this point, however, no party can check if x(%) = 1 f° r ea ch basis state \x), since he knows only the content 
of his R. Thus, every party runs the .Hi -algorithm with R and S, which sets the content of S to "true" if the 
number of l's among the contents of R's of all parties is exactly one and sets it to "false" otherwise (recall 
that the fli-algorithm computes H\ for each basis state in a superposition). This operation transforms the 
state as follows: 

|ijr)| "true")®" i y a S oiving|^soivin g )|"true")® ri + a unso | ving |* unso | ving )|"false")® n , 

where the last n qubits are those in S's. Every party then multiplies the amplitude of each basis state by 
a factor of e l n 9 < n ) , if the content of S is "true" (here, no party measures S; every party just performs 
the phase-shift operator controlled by the qubit in S). Namely, the state over R's and S's of all parties is 
transformed into 

( e ^^W)"a S0 | v i ng |^ S0 | ving )|"true")® n + a uns0 | ving |^ uns0 | ving )|"false")® n . 

Finally, every party inverts every computation and communication of the H\ -algorithm to disentangle S. 

The implementation of ^(^(n)) is similar to that of F X (9 S ^), except that -Fo(^s(n)) multiplies the 
all-zero basis state 1 • • • 0) by e l< ^ s( . n K First, every party runs the iio-algorithm with Ro and S', which sets 
the content of S' to "true" in the case of the all-zero state, and sets it to "false" otherwise. Next, every party 
multiplies the amplitude of the all-zero state by a factor of e 1 ™^™), if the content of S' is "true". Finally, 
every party inverts every computation and communication of the Hq -algorithm to disentangle S'. 
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Algorithm QLE 

Input: classical variable status := "eligible", and integer n 
Output: classical variable status e {"eligible", "ineligible"} 

1. Initialize quantum registers R, S, and S'to |0), |"true"), and |"true") states, respectively. 

2. If status = "eligible", apply A = -7= 1 _ to the qubit in R to generate the quantum state 

3. Perform the exact amplitude amplification consisting of the following steps: 

3.1 To realize F x (ip s r n \) for s(n) = (1 — l/n)™ _1 , perform the following steps: 

3.1.1 Perform an Hi -algorithm with R and S, n. 

3.1.2 Multiply the content of R by a factor of exp(i—6 s t n \) if the content of S is "true". 

3. 1 .3 Invert every computation and communication of step 3.1.1 to disentangle S. 

3.2 Invert the computation of Step 2. 

3.3 To realize -Fb(<^s(n))> perform the following steps: 

3.3.1 Perform an iJo-algorithm with R, S' and n. 

3.3.2 Multiply the content of R by a factor of exp(ii</> s („)) if the content of S' is "true". 

3.3.3 Invert every computation and communication of Step 3.3.1 to disentangle S'. 

3.4 Perform the same operation as is performed in Step 2. 

4. Measure R with respect to basis {|0), |1)}. If the result is 1, then set status to "eligible". 

5. Output status. 

Figure 1 : Algorithm QLE 

More precisely, every party sets his classical variable status to "eligible", and runs Algorithm QLE 
with status and n, given in Figured] After the execution of the algorithm, exactly one party has the value 
"eligible" in status. Since all communication is performed to compute Hq and Hi and their inversions, the 
algorithm runs in 2(Q™ d (^ ) + Q™ d (^i)) rounds with bit complexity 2(Q^ t (H ) + QcfC^i)) for an y 
graph G G Q n , where Hq and Hi are the #o- ai g° r ithm and H\ algorithm, respectively, that we fixed. This 
completes the proof of Theorem Q] 

4 Proof of Theorem |2] 

The proof consists of the following two steps: 

• Reduce computing Hi to computing Hq and the consistency function Cs, where Cs is a Boolean 
function that is true if and only if a subset (specified by S) of all parties has the same classical value 
(its formal definition will be given later). 

• Reduce computing Cs to computing Hq. 

Actually, the second step is almost trivial. We start with the first step. 

4.1 Basic Idea 

Suppose that every party i is given a Boolean variable Xj. We can probabilistically compute Hi{x) with the 
following classical algorithm, where x = (x\, . • . , x n ): Every party i with Xi = 1 sets a variable to or 1 
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each with probability 1/2 and sends r\ to all parties (by taking 5 rounds for the diameter S of the underlying 
graph); every party i with x^ = sets variable to "*" and sends r« to all parties. It is not difficult to 
see that the following three hold: (i) if \x\ = 0, every party receives only (ii) if \x\ = 1, either no 
party receives "1" or no party receives "0", and (iii) if \x\ = t > 2, every party receives both "0" and "1" 
with probability 1 — 2/2*. Therefore, every party can conclude that H\(x) = true (Hi(x) = false) with 
probability one if \x\ = 1 (\x\ = 0) and that Hi(x) = false with probability 1 - 2/2* > 1/2 if \x\ = t > 2. 
Roughly speaking, our quantum algorithm for computing Hi is obtained by first quantizing this probabilistic 
algorithm and then applying the exact quantum amplitude amplification to boost the success probability to 
one. More concretely, we amplify the probability p that there are both and 1 among all r i 's by using the 
exact amplitude amplification. Let and p^ n& \ be the values of p before and after, respectively, applying 
the amplitude amplification. Obviously, if p- m [ t = 0, then pfi na i = also. Hence, for \x\ < 1, p^ aa \ = 0. 
For \x\ > 2, p could be boosted to one if the exact value of p m n were known to every party. However, p-^ 
is determined by t, the value of which may be harder to compute than to just decide whether t = 1 or not. 
Therefore, instead of actual t, we run the amplitude amplification for each t := 2, . . . , n, a guess of t, in 
parallel. We can then observe that exactly one of the (n — 1) runs boosts p to one if and only if \x\ > 2. 

4.2 Terminology 

Suppose that each party i has a bit Xi, i.e., the n parties share n-bit string x = (xi,X2, ■ ■ ■ , x n ). For con- 
venience, we may consider that each Xi expresses an integer, and identify string X{ with the integer it 
expresses. For an index set S C {1, . . . , n}, string x is said to be consistent over S if Xi is equal to Xj for 
all i,j in S. Otherwise x is said to be inconsistent over S. Here, index set S is used just for the defini- 
tion (recall that no party has an index or identifier in the anonymous setting). Formally, we assume that 
every party has a variable z G {"marked", "unmarked"}, and S is defined as the set of all parties with 
z = "marked". If S is the empty set, any x is said to be consistent over S. We also say that an n-qubit 
pure state \tp) = ^^ e | nn ocg\x) = ^^ e (o nn Qg\xi) ■ ■ ■ ® \x n ) shared by the n parties is consistent 
(inconsistent) over S if a$ ^ only for x's that are consistent (inconsistent) over S (there are pure states 
that are neither consistent nor inconsistent over S, but we do not need to define such states). 

We next define the consistency function Cs- {0, l} n — > {"consistent", "inconsistent"}, which de- 
cides if a given string x E {0, l} n distributed over n parties is consistent over S. Namely, Cs{x) returns 
"consistent" if x is consistent over S and "inconsistent" otherwise. 

4.3 The H 1 -Algorithm 

As in the previous section, we fix an ffo- ai g°rithm and a Cg-algorithm, which we use in a black-box manner. 
At the beginning of the algorithm, every party prepares two one-qubit registers X and Y. We shall describe 
an £/i-algorithm that exactly computes function H\ over the contents of X's and sets the content of each Y 
to the function value. Here, we assume that registers Y's are initialized to |"true") for an orthonormal basis 
{|"true"), | "false")} of C 2 . We basically follow the idea in Section l4~Tl to reduce computing H\ to computing 
the binary-valued functions Hq and Cs- However, the idea actually represents a three-valued function, i.e., 
distinguishes among three cases: \x\ = 0, |x| = 1, and \x\ > 2. Thus, we cast the idea into two yes-no 
tests. Namely, the algorithm first tests if \x\ is or not. If \x\ = 0, then it concludes H\(x) = "false". The 
algorithm then performs another test to decide if \x\ < 1 or \x\ > 2, which determines H\(x). 

4.3.1 First Test 

To test if |x| = 0, each party prepares a single-qubit register So, the content of which is initialized to 
| "true"). Each party then performs the ^o-algorithm to exactly compute the value of Hq over the contents 
of X's, and stores the computed value in each So- 
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From the definition of the .ffo-algorithm, this transforms the state in X's and Sq's as follows: 



n 

|x i )x|"true") Y |"true"} So ) ^ (g) (|x 4 )x|"true") Y |F (f))s ), 
i=i i=i 

by rearranging registers, 

= \x) \"twe")® n \H (x)}^. 

X's 

If the content of So is "true", then the content of Y will be set to "false" later (because this means |a?| = 0). 
4.3.2 Second Test 

Next each party tests if \x\ < 1 or \x\ > 2 with certainty. Recall the probabilistic algorithm in which every 
party i sets a variable ri to or 1 each with probability 1/2 if x- L = 1 and sets variable ri to "*" if Xi = 0, 
and then sends r, to all parties. Our goal is to amplify the probability p that that there are both and 1 
among all r^'s by using the exact amplitude amplification. The difficulty is that no party knows the value of 
Pinit (= 1 — 2/2l x l). The test thus uses a guess t of \x\ and tries to amplify p assuming that pi n i t = 1 — 2/2*. 
If t = \x\, then the procedure obviously outputs the correct answer with probability one. If £ ^ \x\, the 
procedure may output the wrong answer. As will be proved later, however, we can decide if \x\ < 1 or 
\x\ > 2 without error from the outputs of (n — l)-runs of the test for t = 2, . . . , n, which are performed in 
parallel. 

We now describe the test procedure for each t. Assume that one-qubit register Z t is initialized to 
|"unmarked "). The initial state is thus 

n 

^2 (ki)x|"unmarked "} Z J , 

xe{o,i}" i=i 

where registers Y and So are omitted to avoid complication. 

The base algorithm A (to be amplified) is described as follows. If the content of X is 1, the party flips 
the content of Z t to "marked", where {("marked "), |"unmarked ")} is an orthonormal basis in C 2 . This 
operation just copies the contents of X to those of Z t (in the different orthonormal basis) for parallel use 
over all t. The state is thus, for any fixed x, 

(g) {\xi)x\z t {xi)) Zt ) = (|l)x|"marked ») Zt J ® (^|0)x|"unmarked ») Zt J 

8=1 

where z t {xi) E {["marked "), ("unmarked ")} is the content of Z t when the content of X is x^ and S is the 
set of the parties whose Z t is in the state |"marked ") (note that \S\ = \x\). 

If the content of Z t is"marked", apply the Hadamard operator H = ( { } 1 ) to the qubit in R t to 

create (|0) + |l))/\/2 (note that register R t of each party % is the quantum equivalent of rjl). The state is 
now represented as, for the x, 

l) x |"marked ")z t J >Rt ) ® ( |0) x |"unmarked ")z t |0) R / 



V2 



5 Here, the contents of R t 's of "unmarked" parties are set to 1 0) , while the classical equivalents, variables n 's, of the parties are 
set to "*" (instead of 0). Actually, the symbol "*" is used to distinguish between \x\ = and \x\ = 1. However, we do not need it 
any longer due to the first test. 
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By rearranging registers, we have 



J^s( |0)Rf ^ |1)R T S ' l < (n ~ l5l) = jjihlS^S' 

X's Z' t s X'S Zt's Rt'S 

where is the n-tensor product of ("marked ") or |"unmarked ") corresponding to x, and 



jfe{o,i} |S| 




(n-|S|) 



This is the end of the base algorithm A. 

We then boost the amplitudes of the basis states superposed in \tp t (x)) such that there are both |0) and 
|1) in R t 's of parties in 5, i.e., the amplitudes of the states that are inconsistent over S, with amplitude 
amplification. Here, function % in Theorem[8]is the consistency function Cs and a(t) = 1 — 2 (i) is used 
as the success probability a. For convenience, we express \ip t (x)) as 

inconsistent) ~i~ Inconsistent)) 

where, 

inconsistent) = ( £ l# ] , 

|^ consistent ) = (|0>®l s l + |i)^i s i) |o)^-i s d. 

To realize F x (9 a u\), every party prepares a single-qubit register S t initialized to ("consistent") and then 
performs the next operations: (1) Perform a C^-algorithm with R t , St and Z t , which computes Cs for each 
basis state |y)|0) n_ l 5 l of \ife(x)) and sets the content of S t to value of Cs', (2) Multiply the amplitude of 
each basis state of R t by a factor of exp (i-^p) if the content of St is "inconsistent"; (3) Finally invert every 
computation and communication of (1) to disentangle St- The state evolves with the above operations as 
follows: 

I z t (£)) I ^(£)) I "consistent") 0n 

h-> \z t {x)) (|n inconsistent ) ("inconsistent") " + i consistent )| "consistent")®") 
h-> \z t {x)) ( (e 4J ^ i )"|n incons i st ent)|"inconsistent") 0n + i consistent ) ("consistent")®" 



^ \z t (x)) ((e^W ^consistent) + (^consistent)) ("consistent")®" 



We have now finished the first operation, F x (9 a u^), of — AFo(cl) a ^)A~ 1 F x (9 a ^) . 

Then A^ 1 is performed. Operation Fo((j) a u\) can be realized with the ifo- ai g°rithm in the same way 
as in Algorithm QLE in the previous section. Finally, perform operation A again. This is the end of the 
amplitude amplification. In summary, the state over Z t 's and R t 's is transformed as follows: 

\zt(x))\i>t(x)) ^ \z t (x))\ip' t (x)), 

where \tf)' t (x)) is expressed as in the following claim. 
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Claim 1 

2lS 



^|SF2 I ^inconsistent) (|5| > 2 and t = \S\), 

P I ^inconsistent) + 7 Inconsistent) (\S\ > 2 and t± |5|), 
I ^consistent ) (\S\ < I and all t) , 



for some P, 7 G C. 



Proof of Claim\E If |5| > 2 and t = |5|, the claim follows from Theorem E If \S\ > 2 and t / |5|, the 

Claim is trivial. If |S| < 1, then \lp t (x)) = Inconsistent); thus, \lf/ t (x)) = ^consistent)- □ 

Each party then prepares a new quantum register S" (initialized to ("consistent")) and performs again 
the Cg-algorithm with R t , S" and Z t , which transforms the state as follows: 



\zt(x)) WtW) |"consistent")®« -> \z t (x)} 



z t 's R t 's s;"s 

where 




l*t(£)> 



#2 |ninconsistent)|"inconsistent")®" (\S\ > 2 and t = \S\), 

/3|ninconsistent)|"inconsistent")®" + 7 |nconsistent)|"consistent")®" (\S\ > 2andt / \S\), 
|nconsistent)|"consistent")® n (\S\ < 1 and all t). 




4.3.3 Final Evaluation 

After the first test and the second tests for t = 2, . . . , n, the state is now 

z t (x)) \%{x)) 

1=2 Rt's, S^'s 

Recall that every party has registers Y, So, S" for t = 2, . . . , n. In the final step of our algorithm for 
computing Hi, every party concludes the value of H%{x) from the contents of So and S"'s as follows: 

• If either the content of So is "true" or the content of S'/ is "inconsistent" for some t G {2, . . . , n}, 
then every party sets the content of Y to "false". 

It is not difficult to show the correctness. If the content of So is "true", then the value of H\{x) is obviously 
"false" (because |a?| = 0). Suppose that the content of So is "false", i.e., |5| 7^ 0. From the definition of 
we can observe the following facts: (1) If |x| := = 1, then the contents of S" are "consistent" 
for all t = 2, . . . , n. (2) If \x\ := \S\ > 2, then the content of S" is "inconsistent" for some t G {2, . . . , n}. 
More precise description of our algorithm is given in Figure [2] 

Lemma 9 For any graph G G Q n , if every party knows the number n of parties, there is an H\-algorithm 
that runs in O(Q r g d (H ) + Q x § d {Cs)) rounds with bit complexity 0{n{Q^\U Q ) + Q h g(C S ))), where H 
and Cs are any HQ-algorithm and any Cs-algorithm, respectively. 



Proof. The correctness follows from the above description of the algorithm. For the complexity, all com- 
munications are performed for computing Ho and then computing C5 for t = 2, n in parallel. Therefore, 
the lemma follows. □ 
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4.4 Computing Cs with Any H -Algorithm 

We now show that computing Cg is reducible to computing Hq. 

Lemma 10 For any graph G G Q n , there is a Cs-cdgorithm that runs in 0{Qq{Hq)) rounds with bit 
complexity 0(Q^('Hq)), where Hq is any HQ-algorithm. 

Proof. Function Cs can be computed by first computing in parallel Hq and H\g\ over the input bits of the 
parties associated with S, and then computing OR of them. To compute Hq over the |5| bits with any Hq- 
algorithm over n bits, every party i with i S sets his input to 0, and all parties then run the i^o-algorithm. 
Similarly, (the negation of) H\g\ over the \S\ bits can be computed except that every party i with i € S 
negates his/her input. □ 

Lemmas l9l and [lOl imply that, for any graph G € Q n , there is an i^i-algorithm that runs in 0(Q™ d (-ffo)) 
rounds with bit complexity 0(n • Qq (Hq)). This completes the proof of Theorem^ 

Theorem [2] can easily be generalized to the case where only an upper bound N of n is given to every 
party. Suppose that we are given an ifo-algorithm that works for a given upper bound N of n. The proof 
of Lemma[lO]then implies that there exists a Cg-algorithm that can work even if only an upper bound N is 
given. We can thus make an H\ -algorithm that works for the upper bound N, by performing the first test 
and then the second tests for t = 2, . . . , N in parallel. 

Theorem 11 If only an upper bound N of the number n of parties is provided to each party, function 
H\ can exactly be computed without intermediate measurements for any possible quantum state as input 
in 0{Q rnA {Ho)) rounds with bit complexity 0(N ■ Q hlt (Ho)) on an anonymous quantum network of any 
unknown topology. 



5 Improved Algorithm for LE n 

As an application of Theorems [T] and |2 we present a quantum algorithm that exactly solves LE n , which runs 
with less round complexity than the existing algorithms while keeping the best bit complexity. 

Proof of Corollary \3\ We first give a simple ifo- ai g°rithm in order to apply Theorems Q] and [2] The 
algorithm is a straight-forward quantization of the following deterministic algorithm: Every party sends his 
input bit to each adjacent party (and keep the information of the bit for himself). Every party then computes 
the OR of all the bits he received and the bit kept by himself and sends the resulting bit to each adjacent 
party (and keep the information of the bit for himself). By repeating this procedure A times for an upper 
bound A of the network diameter, every party can know the OR of all bits and thus the value of Hq. This 
classical algorithm can easily be converted to the quantum equivalent with the same complexity (up to a 
constant factor). 

Thus, we have proved the following claim. 

Claim 2 Let G be any graph in Qn> and let in be the number of edges in G. Then, there is an HQ-algorithm 
that runs in 0(A) rounds with bit complexity O(Am) on an anonymous quantum network of the underlying 
graph G (i.e., Qg^fto) = 0(A) and Qg*(W ) = 0(Am)for some HQ-algorithm Hq) if the upper bound 
A of the diameter of G is given to each party. 

Corollary [3]follows from Theorems [Q [2] and Claim[2]with the trivial upper bound n of A. □ 

Corollary [3] improves the complexity of the existing quantum algorithms for LE n in Ref. liT8i . For 
particular classes of graphs, it is known that H± can be computed as efficiently as Hq. In this case, a direct 



14 



application of Theorem Q] gives a better bound. For a ring network, both Hq and Hi can be computed in 
0(n) rounds with bit complexity 0(n 2 ). 

More generally, Kranakis et al. lfl4l developed a random-walk-based classical algorithm that efficiently 
computes any symmetric function if the stochastic matrix P of the random walk on the underlying graph 
augmented with self-loops has a large second eigenvalue (in the absolute sense). By using this algorithm to 
compute Hq and H\, Theorem Q] yields an efficient algorithm for the graphs with a large eigenvalue gap. 

Corollary 12 Let G G Q n and let G' be the graph G with self-loops added to each node. Let A be the 
second largest eigenvalue (in absolute value) of the stochastic matrix P associated with G'. There is an 
algorithm that exactly elects a unique leader in O — TogX^) rounc ^ s with bit complexity O (^ — j^x(log n) 2 ^j 
on an anonymous quantum network with the underlying graph G, where m is the number of edges of G. 

In particular, a unique leader can exactly be elected in 0{r?l d log n) rounds with bit complexity 
0(n 1+2 / d log n) for an anonymous quantum d-dimensional torus for any integer constant d > 2, since 
— 1/log A G 0(n 2 / d ). 

We next consider a more general setting, in which only an upper bound N of n is given to each party. In 
this case, our algorithm can be modified so that it attains the linear round complexity in N. The algorithm, 
however, has a larger bit complexity than than 0(mN 2 ), which is attainable by an existing algorithm. 

Corollary 13 Let G be any graph in Q n , and let m be the number of edges in G. If only an upper bound 
N of the number n of parties is given to every party, the leader election problem can exactly be solved in 
0(N) rounds with bit complexity 0(mN 3 ) on an anonymous quantum network with the underlying graph 
G. 

Proof. Theorem QT] and Claim[2]imply that there exist an Ho-&\gonthm and an H\ -algorithm that work even 
if only an upper bound N of n is given to each party. 

Since Theorem Q] depends on the high success probability of the base randomized algorithm (i.e., the 
algorithm in which every party flips a coin that gives heads with probability 1/n), the reduction works only 
if N = n. We thus modify the reduction in Theorem[T]as follows: (1) We attempt the quantum reduction 
in Theorem Q]for every guess n' of n in parallel, where n' = 2, . . . , N. (2) Each attempt is followed 
by performing the Hi -algorithm to verify that a unique leader is elected. Observe that for at least one 
of n' = 2, . . . , N, a unique leader is elected, which is correctly verified by Step (2) due to Theorem [TT] 
Therefore, the round complexity is O(N) and the bit complexity is 0(mN 3 ). □ 



6 Computing Boolean Functions 

Once a unique leader is elected, a spanning tree can be constructed by starting at the leader and traversing 
the underlying graph (e.g., in a depth first manner) and the leader can assign a unique identifier to every 
party by traversing the tree. Moreover, if a unique leader exists, the underlying graph is recognizable, i.e., 
every party can know the adjacency matrix of the graph, as shown in Lemma |T4j Hence, it is possible to 
compute a wider class of Boolean functions than symmetric functions, i.e., all Boolean functions that may 
depend on the graph topology (but are independent of the way of assigning unique identifiers to parties). We 
call such functions computable functions. 

Lemma 14 Once a unique leader is elected on an anonymous quantum network of any topology, the under- 
lying graph can be recognized in 0(n) rounds with 0(n 3 ) bit complexity. 
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Proof. Once a unique leader has been elected, the following procedure can recognize the underlying graph. 
First construct a spanning tree in 0(n) rounds with 0(m) bit complexity by traversing the graph for the 
number m of the edges of the underlying graph. Second assign a unique identifier to each party in 0(n) 
rounds with bit complexity 0(n log n) by traversing the spanning tree starting at the leader (the first and 
second steps can be merged, but we here describe them separately just for simplicity). Finally, gather into 
the leader the information of what parties are adjacent to each party by conveying adjacency matrices along 
the spanning tree as follows: Each party communicates with each adjacent party to know the identifier of 
the adjacent party in one round with 0(m log n) bit complexity. Next, each leaf node i prepares an n-by-ra 
adjacency matrix with all entries being zero, puts 1 in the entries (i, j) of the matrix for all adjacent parties 
j, and then sends the matrix to its parent node of the tree with 0(n 2 ) bit complexity. Every internal node k 
of the tree merges all received matrices, puts 1 in the entries (k,j) for all adjacent parties j, and then sends 
the resulting matrix to its parent node. Finally, the leader can obtain the adjacency matrix of the underlying 
graph, and he then broadcasts the matrix along the tree. These gathering and broadcasting steps take 0(n) 
rounds with bit complexity 0(n 3 ). □ 

We now give a proof of Corollary 01 

Proof of Corollary \4\ Once a unique leader is elected and the underlying graph is recognized, it is sufficient 
for the leader to gather the input bit of every party with his identifier of O(logn) bits along the spanning 
tree. This input gathering can be done in 0(n) rounds with bit complexity 0(n 2 log n). Thus, together with 
Corollary [3] and Lemma [14] any computable Boolean function can be computed in O(n) rounds with bit 
complexity 0(mn 2 ) for the number m of the edges of the underlying graph. More generally, suppose that 
every party i has a qubit so that the n parties share some ra-qubit state £, and let p be any n-qubit quantum 
state computable from £ and the underlying graph. Then, by replacing an input bit with an input qubit for 
each party in the above proof for classical case, the leader can gather the n qubits to have £ in his local 
space. Now the leader can locally generate p from £, and send back the corresponding qubit to each party to 
share p, again along the spanning tree, in 0(n) rounds with 0(n 2 log n) bit complexity. This completes the 
proof of Corollary |4] □ 



7 GHZ-State Sharing Problem 

In this section, we prove Theorem [5] by reducing the GHZ-state sharing problem to computing func- 
tion Fjf, where is a function such that Ffr(xi, . . . ,x n ) = Ya=i Xi ( m °d k) for distributed inputs 
Xi G {0, . . . , k — 1}. Hereafter, we assume the existence of an Fj. -algorithm. The basic idea can be 
well understood by considering the case of k = 2. 

7.1 Basic Case (k = 2) 

The algorithm consists of two phases. The first phase runs two attempts of the same procedure in parallel, 
each of which lets all parties share either (|O) 0n +| 1)®") /y/2 or (|O) 0n - | l)® n )/y/2 each with probability 
1/2. If the parties share at least one copy of (|0)® n + 1 l)® n )/y/2 after the first phase, they succeed. If the 
parties share two copies of (|O) 0n - |l)® n )/\/2, the second phase distills the state (|0)® n +|l) 0n )/\/2 from 
them with classical communication and partial measurements. A more detailed description is as follows. 

Let i G {1, 2} be the index of each attempt of the procedure performed in the first phase. The first phase 
performs the following procedure for each i (notice that function F2 is equivalent to the parity of distributed 
n bits). 

1. Every party prepares two single-qubit registers Rj and Sj initialized to |0). 
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2. Every party applies Hadamard operator H = 4=(} J x ) to Rf. \0)® n -> Zlxe{o,i} n 1^) 

3. All parties collaborate to compute the parity (i.e., the sum modulo 2) of the contents of Rj of all parties 
and store the result into Sj of each party: 

-4 E i*>i°r^ E i-)iki(mod 2) r. 

v xe{o,i}" Se{o,i} n 

4. Every party measures Sj in the basis {|0), |1)} and applies H to R^: 

if |0) was measured, 



if |1) was measured. 

If the state over all Rj's is (|0)® n +|l)® n )/\/2 for at least one of i = 1, 2, we are done; otherwise, we go on 
to the second phase. Observe that the state over all Ri's and R2's is 

mt - W) ® (i°)r 2 " - W) = (io>tri°>tr +i i >Rri i >R 2 n ) - 

where we omit normalization coefficients. If every party locally computes the parity of the contents of Ri's 
and R 2 's and measures the result, the entire state will be either |0)^|0)f^ or \0)^\1)^ + 

I |0}f n - It is easy to see that the state |0)® n +| l)® n can be obtained from any of these states by applying 
a CNOT to R2 using Ri as control (all R2's are disentangled). If we use a quantum simulation of a classical 
algorithm that deterministically computes the parity of distributed n bits (e.g., view -based algorithms EUl 
[331 [TH), our algorithm uses only a constant-sized gate set. 

7.2 General Case (k > 2) 

In the following, we assume A;-level qudits are available for simplicity (the algorithm can easily be carried 
over the case where we are allowed to use only qubits). Any pure state of a fc-level qudit can be represented 
as Yli=o a i\^} w ^ tn complex numbers 014 such that Yli=o \ a i\ 2 = 1 (f° r k = 2, this is just a qubit). 

Our algorithm uses the following operator over one A;-level qudit, instead of H used in the case of 
k = 2: Forx e {0, . . . , jfe-1}, 

W*|z) = ^X>?|j), 
V^=o 

where u k = eT*. In what follows, we denote (X)Jl£w£ x |a;) l8n ) /^by CAT fc (i). For instance, CAT 2 (0) 
denotes (|0)® n + |l)® n )/V2. 

7.2.1 First Phase 

The first phase is for the purpose of sharing k states drawn from the set {CATfc(t) : t G {0, . . . , k — 1}} . 
The operations are described as follows, which are similar to the case of k = 2. 

First Phase 



E 



4 |O)® n +|l) 0n 

X) 



■Jon-l ^ x f2 

v xe{0,l} n : |2| is even v 



E 



Jon-1 ./o 
V x£{Q,l}": 121 is odd V 
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For i = 1, 2, . . . , k, perform the following operations in parallel: 

1. Prepare a single-qudit register R« initialized to |0). 

2. Apply W k to the qudit in R;, which maps the state |O) 0n into (W fc |0))® n = \v)- 

3. Run an -algorithm to compute the value of := Y^j=\ Vj ( m °d k), where yj is the content 
of Rj of the jth party, and store the result into a single-qudit register S^: 

y=o v y=0 

4. Measure Sj in the basis {|0), . . . , \k — 1)}. If s« G {|0), . . . , \k — 1)} is measured, the state is 

1 



E \y)- 



,/h.n-l 

ye{0,...,k"-l}: 

E™=1 %= s i ( mod *0 



5. Apply WJ. to Ri. 



The following lemma implies that, for each i £ {1, . . . , A;}, the state of Rj's after the first phase is 
CATfc(— Si mod k). If Si = for some i, we are done. Otherwise, the parties perform the second phase 
(described later) to distill the state CATfc(O) from the k states shared by all parties. 



Lemma 15 




E \y)- 



ye{0,...,k n -l}: 
*+E?=i W=0 (mod k) 



The proof is given in Appendix. 



7.2.2 Second Phase 

Suppose that, after the first phase, all parties share k states, CATfe(— Sj mod k) with Sj ^ for % = 1, . . . , k. 
Then, there must be two integers l,m G {1, . . . , k} with s; = s m , since s^, s m £ {1, . . . , A; — 1}. We can 
distill the state CATfc(O) from the states CATfc(— mod A;) and CATfe(— s m mod A;) as follows. 

Suppose that n parties share two copies of CATfc(t) for any t £ {1, . . . , A; — 1} for their quantum 
registers Ri's and R2's. Namely, the state over all Ri's and R2's is 




Ri's R 2 's 



By rearranging the registers, the state is 

j fc-i fc— l 

-^^4 r (|x) Rl |r-x (mod fc)) Ra ) 

r=0 x=0 

Every party then performs the following operations. 
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Second Phase 



1. Add the content of Ri to the content of R2 under modulo k: The state becomes 



1 



fc-i fe-i 



A: 



r mod &)r 2 ) 



r=0 x=0 



2. Measure R2 in the basis {|0), . . . , \k — 1)} and let r be the measurement result: The state is 



j. r k— 1 



<8>n 

Ri • 



3. Output Ri. 



7.2.3 Proof of Theorem H 

The correctness of the algorithm follows from the above description of the algorithm. The communication 
occurs only when computing Fp. (in the first phase). Thus, the algorithm works in 0(Q Tnd (J r k)) rounds 
with bit complexity 0(Q (T^)), where is the given F^-algorithm. The algorithm works with the 
operators wl, the operators for computing classical functions (such as addition under modulo k) that 
are independent of n, except the given i^-algorithm. Therefore, the algorithm can be implemented with a 
gate set whose size is finite and independent of n if an F^-algorithm is given. □ 

8 Conclusion 

We proved that the leader election problem LE n can exactly be solved with at most the same complexity (up 
to constant factor) as that of computing symmetric Boolean functions on an anonymous quantum network. 
In particular, the hardness of the leader election problem is characterized by that of computing Ho, a function 
of checking if all parties each have the bit 0. This shows that quantum information can change the hardness 
relation among distributed computing problems (recall that Ho can be computed for all network topologies 
but LE n cannot, on anonymous classical networks). 

In the proof, we used (given) distributed algorithms for computing symmetric Boolean functions to 
implement phase-shift operators of amplitude amplification. Here, assuming that the underlying graph is 
undirected, we were able to erase the garbage left by the algorithms by the standard technique of inverting 
all operations and communications performed. We do not know if our proof works (with modifications) even 
on directed networks. It is also a open question as to whether LE n can exactly be solved in rounds linear 
in the number of parties when the underlying graph is directed (notice that the leader election algorithms in 
Ref. lfl8l work with some modifications even on directed networks, but they require rounds super-linear in 
the number of parties). 

We also gave an quantum algorithm that exactly solves the GHZ-state sharing problem in rounds linear 
in the number of parties with a constant-sized gate set, if the network is undirected. It is still open whether 
the problem can exactly be solved in linear rounds on directed networks. If much more rounds are allowed, 
we can solve the problem on directed networks by modifying the idea in Ref. |[T8l . 
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Appendix 



A GHZ-State Sharing Problem 



Proof of Lemma\T5\ We first prove the lemma for t = 0. The proof can easily be generalized to the case of 
t > 0. Notice that 



k 



k—1 \ fe n — 1 k n — l 

$ E I*) 8 ") - 7= E - vPff g (4°' + • • ")i,>. (■) 



where a y := 4*° and a y x) /V¥ = <y|Wf »®". Let y = ym . . . y n for Vj G {0, . . . , k - 1}. By 

the definition of we have 



a y ] = = (for < x < k - 1). 

3=1 



Therefore, the following claim holds. 
Claim 3 



jfc-i fe-i 



x=0 x=0 

„(1) ^ n , ,1 , ,2 , ,fc-li 



where a K y ' e {1,ojI,ljI, ... ,u k }. 

We next calculate a y for each y. If oty = 1, then a a = Sz=o( Q 4 1 "') :E = /c by the above claim. If ay = wj| 
for some number p prime to k, then 



k-l 
x=0 



Suppose that a y = uj q k for some number q not prime to k. Let y be the greatest common divisor (GCD) of 



q and k. Since = e 27T k lf % is the (k/g)th root of 1, we have Ylj=o 1 { a y^V = 0- Therefore, 

k-l g k/g-1 

% = E(4 x) r = E E* J = o. 

x=0 m=l j'=0 

Hence, only the basis states \y) such that a y = 1 have non-zero amplitudes. Since = n?=i a; fc' 

En 
i=i W 

E = E k \ yS >- 

S/=° y€{0,...,k n -l}: 

E"=i%=0 (mod fc) 

Thus, the lemma for t = follows from eq. CD). 
We now consider the case of t > 0. Suppose that 



k—1 \ k n —l k n —l 
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where (3 y = ElZlA^ and ffl 1^ = <y|Wf n (w^|x)® n ). Then, we have ffl = u^a^ = 
{oj\.a^) x . This implies that 

By an argument similar to the case of t = 0, only the basis states \y) such that fffl = 1 have non-zero 
amplitudes. The lemma follows from = uj^^ 3 ^ 1 V] . □ 
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.Hi -Algorithm 

Input: Single-qubit registers X and Y (W.L.O.G., initialized to |"true")), an integer n. 
Output: Single-qubit registers X and Y. 

1. Initialize n single-qubit registers Ro, R2, • • ■ , R n to |0). 

2. Prepare a single-qubit register So and then perform the following steps of the first test: 

2. 1 Copy the content of X to that of Ro in the { |0) , 1 1) } basis (i.e., apply CNOT to Ro with X as control). 

2.2 Perform an _ff -algorithm with R , So and n, which computes H over the contents of R 's of all parties 
and store the result into So- 

3. Perform the following steps of the second test for t = 2, . . . , n in parallel: 

3.1 If the content of X is 1, set the content of Z t to "marked "; otherwise set it to "unmarked ". 

3.2 If the content of Z t is "marked ", apply the Hadamard operator on the qubit in R t (to create 

3.3 To realize F x (VWt) )> prepare a single-qubit quantum register S t and perform the following operations: 

3.3.1 Perform a C^-algorithm with R t , St, Z t and n, which computes Cs over the contents of R t 's of all 
parties for £ defined by the contents of Z t 's, and stores the result into St. 

3.3.2 Multiply the state of R t by a factor of e l ^^ a (^ if the content of S t is "inconsistent", where a(t) is 
the probability of measuring inconsistent states in ( ) > i- e -' 1 — 2 (^)*- 

3.3.3 Invert every computation and communication of Step 3.3.1 to disentangle St. 

3.4 Invert the computation in Step 3.2. 

3.5 To realize F (<^ a (t))> prepare a single-qubit quantum register S' t and perform the following operations: 

3.5.1 Perform the _ffo- al g°rithm with R t , S' t and n, which computes Hq over the contents of Ro's of all 
parties and store the result into S' t . 

3.5.2 Multiply the state of R t by a factor of e 1 » ^ a <*> if the content of S' t is "true". 

3.5.3 Invert every computation and communication of Step 3.5.1 to disentangle S' t . 

3.6 Perform the same operation as in Step 3.2 

3.7 Prepare a fresh single-qubit register S", and perform a Cg-algorithm with R t , S", Z t and n, which com- 
putes Cs over the contents of Rf's of all parties for S defined by the contents of Z t 's, and stores the result 
into S^. 

4. If either the content of So is "true" or the content of S" is "inconsistent" for some t £ {2, . . . , n}, then turn Y 
over (i.e., transform the state |"true") of Y into |"false")). 

5. Invert every computation and communication of Steps 2 and 3 to disentangle all registers except X and Y. 

6. Output X and Y, and then halt. 



Figure 2: H\ -Algorithm 
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